[Snort-devel] Reputation preproc priority showing "blacklist" when set to "whitelist"

Mike Cox mike.cox52 at ...2499...
Wed Jul 29 08:30:40 EDT 2015


Ah, OK, thanks.  I had whitelist set to unblack.

-MIke Cox

On Tue, Jul 28, 2015 at 1:54 PM, Hui cao <huica at ...3461...> wrote:

>  Hi Mike,
>
> Thanks for reporting this. This is an output issue. It only outputs
> whitelist when whitelist means trust. When it means unblack, it outputs
> blacklist. It should output whitelist in both cases.
>
> Best,
> Hui.
>
>
> On 07/28/2015 01:27 PM, Mike Cox wrote:
>
> When enabling the reputation preprocessor and not setting the "priority"
> option, I see this (the default value) when Snort starts up:
>
>  Reputation config:
>   ...
>   Reputation priority:  whitelist
>
>
> However, if I set the "priority" option to "whitelist" (it can only be set to "whitelist" or "blacklist"), I get this when Snort starts up:
>
> Reputation config:
>   ...
>   Reputation priority:  blacklist
>
>
> I have not tested to see if this is just an output issue or if it actually affects engine behaviour.  However, I see this on Snort 2.9.7.3 and also now on Snort 2.9.7.5, as well as previous versions.
>
>
> Thanks.
>
>
> -Mike Cox
>
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Snort-devel mailing listSnort-devel at ...3458...://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20150729/62b7f3d9/attachment.html>


More information about the Snort-devel mailing list